Privacy Policy

Integrated Research Application System (IRAS)


Privacy Policy

Version 2.0 (July 2018)

This Privacy Policy applies to the Integrated Research Application System (“IRAS”) ( (the “Website”).  The Website is provided by the Health Research Authority (“HRA”), a non-departmental body of the Department of Health and Social Care in collaboration with a number of organisations involved in the research approval process. The software and web services are maintained by BGO Media, with Vysiion providing the Data Infrastructure.  Reference to "we" or "our" is to HRA and / or BGO Media and / or Vysiion.

By accessing the Website you agree to the collection, use and transfer of that information in accordance with terms of this Privacy Policy and the Website's Terms and Conditions. Please read the following to understand how we will treat personal data.

Identity and contact details of the data controller (and where applicable, the controller’s representative) and the data protection officer

Data Protection Officer:

Data Controller:
Health Research Authority
Skipton House, 80 London Road
London, SE1 6LH

Data Processors:
BGO Media
Headquarters: 159 Tzar Boris III blvd., fl. 10, 1618 Sofia, Bulgaria
All personal data is processed in the UK.

Data Infrastructure
Connect 17, Avon Way, Langley Park,
Chippenham, Wiltshire, SN15 1GG

Information about the data we collect from you

Some of the information we collect will be personal data. Personal data means any information about an individual from which that person can be identified. Data we collect includes :

  • personal information such as name, email address, phone number, mailing  address
  • any other information required to process your research application such as details of your research sponsor
  • information you provide when you contact us about your use of the Website.

Additionally we may collect data about your interactions with the HRA for the purposes of improving user experience.  This includes:

  • your operating system, browser, IP address
  • the pages you browse
  • the referring page that led you to the current page, and
  • your software and aspects of its configuration.

The Website also uses cookies. A cookie is a small file which asks permission to be placed on your computer’s hard drive. Cookies help to analyse web traffic as well as enable the web server to identify and track the web browser. We use session cookies on the Website to keep track of you whilst you investigate the Website. Session cookies will be deleted from your computer when you close your browser. As part of maintaining and improving the quality of the Website, we use Google Analytics as a way of generating statistical information relating to our Website. This is then used to create reports on the use of the website with Google storing this information. Google’s privacy policy can be found here .

Purpose of the processing and the lawful basis for the processing

In performing our regulatory role, the HRA delivers the Integrated Research Application System (IRAS), a single system for applying for the permissions and approvals for health, social and community care research in the UK.  IRAS provides a platform for users to enter information about their research for the purposes of seeking approvals and maintaining these approvals.

The information provided during the application process remains private to the applicant.  However depending on the nature of the research being undertaken, this information may be accessed and / or reviewed by other review bodies to enable the approval process to be completed. When this happens, your data will be processed in accordance with the review bodies’ privacy policies. For more detail please see the next section.   

The lawful basis for processing Personal Data under the General Data Protection Regulation is in the HRA’s exercise of Official Authority as set out in the Care Act 2014 found here, specifically the HRA’s role in the regulation of health and social care research.

Where sensitive personal data revealing racial or ethnic origin, religious, political opinions, biometric and / or genetic data is required as part of research, this information will only be processed in accordance with the purposes of the  research as it relates to health, social and community care.

Any recipient or categories of recipients of the personal data

In the performance of the approvals process, data may be shared with the following organisations:

  • The National Institute of Health Research (NIHR) Clinical Research Network (CRN). Their privacy policy can be found here
  • NHS organisations in England, Wales and Scotland, and Health and Social Care (HSC) organisations in Northern Ireland  in accordance with UK Policy Framework for Health & Social Care Research found here
  • Research Ethics Committees (RECs) who abide by the Governance Arrangements for Research Ethics Committees (GAfREC)  found here
  • Confidentiality Advisory Group (CAG): who provide advice under two separate legal frameworks – control of Patient Information as well as the dissemination of information: here
  • Her Majesty’s Prison and Probation Service (HMPPS): here
  • Medicines and Healthcare products Regulatory Agency (MHRA): here
  • Administration of Radioactive Substantances Advisory Committee (ARSAC): here
  • The Scottish, Welsh and Northern Ireland equivalents of the HRA. Each with their governance and frameworks for research.
    • Health and Care Research Wales here
    • Health and Social Care (HSC) Public Health Agency: here
    • NHS Research Scotland: here

Data may also be shared with BGO Media for the purposes of fault diagnosis and issue resolution.

Details of transfers to third country and safeguards


Retention period or criteria used to determine the retention period

The retention period of data can be up to 30 years depending on the type of research as indicated in the Records Management Code of Practice for Health and Social Care 2016 which can be found here.  We will retain personal data only in accordance with that Code of Practice. 

The existence of each of data subject’s rights

Users’ accounts in IRAS can be deleted at the request of the user at any given time.

Other individual rights apply:

  • The right to be informed;
  • The right to access your personal data;
  • The right to rectification;
  • The right to restrict and object to processing; and
  • The right not to be subject to automated decision-making.

We have the right to refuse requests to exercise these rights in certain circumstances, and this will be considered on a case by case basis.

The right to lodge a complaint with a supervisory authority

Information Commissioner's Office, Wycliffe House
Water Lane, Wilmslow, Cheshire SK9 5AF. Contact details here

Information on exercising your Rights under the General Data Protection Regulations can be found here



IRAS Integrated Research Application System, version 5.15, 01/06/2020, IRAS Dataset version 3.5.
The Health Research Authority (HRA) acknowledges the Integrated Research Application System (IRAS) partners in developing IRAS content. © Health Research Authority 2020.
Copyright and other intellectual property rights in the content of the Integrated Research Application System (IRAS) belong to the HRA and all rights are reserved. Terms & Conditions, Privacy Policy.